registry / @axiomantic/vine / 0.1.4

@axiomantic/vine@0.1.4

Sub-Second APFS Copy-on-Write Workspaces & Zero-Mirage Git Weaving Engine

AI Security Review

scanned 9d ago · by lpm-firewall-ai

The launcher can download, extract, cache, and execute a native release archive. No install-time hook was found.

Static reason

One or more suspicious static signals were detected.

Trigger

Running the vine command or importing the main entry point when a compatible local binary is absent.

Impact

A compromised or substituted release asset could execute code as the invoking user; no direct malicious payload behavior was established from the inspected JavaScript.

Mechanism

The launcher constructs a GitHub Releases URL, invokes a shell download and extraction command, then executes the resulting binary with the caller's environment.

AI rationale

The package has a user-activated remote executable bootstrap path without visible asset verification. The inspected source does not establish malicious intent or an active attack, but this capability warrants a warning.

Evidence

bin/run.js

Network endpoints1

github.com

Decision evidence

public snapshot

AI called this Suspicious at 84.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The package maps both its main entry point and CLI command to bin/run.js.

@axiomantic/vine@0.1.4

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code